Learn How Hackers Are Hiding Malware | Penetration Testing Guide

Summary: The video discusses the concept of Alternative Data Streams (ADS) in Windows, focusing on how they can be leveraged to enhance file persistence on a system. It highlights the benefits and functionalities of ADS, along with practical demonstrations on how to create and manipulate these streams for embedding various forms of data, including executable scripts.

Keypoints:

• The main problem with file persistence is ensuring files survive system reboots and memory cleanups.
• Alternative Data Streams (ADS) is a feature exclusive to Windows, allowing multiple data streams within a single file.
• Files can contain standard content while also housing hidden streams that can store additional data, including text, scripts, and executables.
• ADS can be accessed and manipulated through both PowerShell and CMD, although CMD is often preferred for simplicity.
• The video includes a demo on using ADS to embed harmful content without creating visible files on the system.
• A method for executing files stored in ADS is demonstrated, showcasing various execution techniques and options.
• The process of creating scheduled tasks to execute ADS contents upon startup is explained, requiring administrative privileges.
• Programmatic engagement with ADS using C++ is also detailed, outlining how to read and write data to ADS streams.
• ADS can store diverse types of data, making it a versatile tool for enhancing file persistence and hiding malicious payloads.
• The video encourages viewers to explore ADS for further skills development and to engage with the creator via Patreon for additional resources and projects.